IN THE CLAIMS : 

Please amend claims 1-8, 11, and 16-18 as follows. Please add new claims 19-20 
as follows. 



1. (Currently Amended) A distribut e d routing d e vic e An apparatus comprising: 

a routing unit r outer configured to route subscriber traffic flow between at least 
two wireless access networks and an ff -internet protocol network s wherein the at least 
two wireless access networks correspond to different customer networks; and 

a g e nerating unit generator configured to generate at least one instance for 
executing a security function on a subscriber traffic flow, so that physically one security 
instance for subscribers of at least two wireless access networks is present and logically 
at least one of the at least two wireless access networks has a respective security instance. 

2. (Currently Amended) The distribut e d routing d e vice apparatus according to 
claim 1, wherein at least one logical part of the security instance is associated with a 
context of a respective one of the wireless access networks and comprises an interface 
with the respective wireless access network. 

3. (Currently Amended) The distribut e d routing d e vice apparatus according to 
claim 1, further comprising an associating unit associating device configured to associate 
the subscribers with the at least two wireless access networks. 

4. (Currently Amended) The distribut e d routing d e vic e apparatus according to 
claim 1 2 further comprising a reorganizing unit reorganizer configured to reorganize a 
context from a first logical part of the security instance associated with a first wireless 
access network of the at least two wireless access networks to a second logical part of the 
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security instance associated with a second wireless access network of the at least two 
wireless access networks. 

5. (Currently Amended) The distributed routing device apparatus according to 
claim 4, wherein the reorganizing unit reorganizer is configured to reorganize the context 
from the first logical part to the second logical part in case of a handover of a subscriber 
from the first wireless access network to the second wireless access network. 

6. (Currently Amended) The distribut e d routing d e vice apparatus according to 
claim 1, wherein the security function comprises at least one of a Virtual Privat e N e twork 
virtual private network , routing and firewall function. 

7. (Currently Amended) The distributed routing d e vic e apparatus according to 
claim 1, wherein the di s tributed routing d e vice apparatus is located at a provider edge of 
the IP -internet protocol network. 

8. (Currently Amended) A method for routing subscrib e r traffic flow in a 
distribut e d routing d e vic e betw e en at l e ast two wir e l e ss acc e ss n e tworks and an IP 
network, the method comprising: 

providing at least one instance for e x e cuting to execute a security function on the 
subscriber traffic flow routed between at least two wireless access networks and an IP 
network, wherein the at least two wireless access networks correspond to different 
customer networks, by logically separating the at least one instance for at least two 
wireless access networks, so that physically one security instance for subscribers of the at 
least two wireless access networks is present and logically at least one of the at least two 
wireless access networks has a respective security instance. 



9. (Previously Presented) The method according to claim 8, further comprising: 
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associating at least one logical part of the security instance with a context of a 
respective one of the wireless access networks; and 

providing an interface between the at least one logical part and the respective 
associated wireless access networks. 

10. (Previously Presented) The method according to claim 9, further comprising: 
modifying the context in the at least one logical part by the associated wireless 

access network via the respective interface. 

11. (Currently Amended) The method according to claim 10, further comprising: 
detecting whether the context to be modified comprises a security code; and 

in case the context comprises the security code, inhibiting the step-ef-modifying of 
the context. 

12. (Previously Presented) The method according to claim 8, further comprising: 
associating the subscribers with the wireless access networks. 

13. (Previously Presented) The method according to claim 8, further comprising: 
reorganizing a context from a first logical part of the security instance associated 

with a first wireless access network of the at least two wireless access networks to a 
second logical part of the security instance associated with a second wireless access 
network of the at least two wireless access networks. 

14. (Previously Presented) The method according to claim 13, wherein the 
reorganizing comprises reorganizing the context from the first logical part to the second 
logical part in case of a handover of a subscriber from the first wireless access network to 
the second wireless access network. 
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15. (Previously Presented) The method according to claim 14, wherein the 
reorganizing comprises reorganizing a handover context pertaining to the subscriber 
handed over from the first wireless access network to the second wireless access network. 

16. (Currently Amended) A network node in a wir e less acc e ss network for 
routing subscrib e r traffic flow to and from an IP network, th e n e twork nod e comprising : 

a connection for connecting which connects a network node to a distributed 
routing device for routing configured to route subscriber t raffic flow to and from an IP 
internet protocol network, wherein the distributed routing device is configured to route 
subscriber traffic flow between at least two wireless access networks and an IP -internet 
protocol network, wherein the at least two wireless access networks correspond to 
different customer networks, and the distributed routing device comprises at least one 
instance for executing a security function on a subscriber traffic flow, so that physically 
one security instance for subscribers of at least two wireless access networks is present 
and logically at least one of the at least two wireless access networks has a respective 
security instance, wherein at least one logical part of the security instance is associated 
with a context of a respective one of the wireless access networks and comprises an 
interface with the respective wireless access network; and 

th e n e twork node compris e s modifying m e ans for modifying a modifying device 
configured to modify the context in the at least one logical part of the security instance 
associated with the respective one of the wireless access network via a respectively 
provided interface. 

17. (Currently Amended) A network system comprising: 

at least two wireless access networks and a distributed routing device for routing 
configured to route subscriber traffic flow between the at least two wireless access 
networks and an IP -internet protocol network, wherein the at least two wireless access 
networks correspond to different customer networks, wherein the distributed routing 
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device is configured to route subscriber traffic flow between at least two wireless access 
networks and an jP — internet protocol network, and the distributed routing device 
comprises at least one instance for executing a security function on a subscriber traffic 
flow, so that physically one security instance for subscribers of at least two wireless 
access networks is present and logically at least one of the at least two wireless access 
networks has a respective security instance. 

18. (Currently Amended) An apparatus, comprising: 

routing means for routing subscriber traffic flow between at least two wireless 
access networks and an iP -internet protocol network ?, wherein the at least two wireless 
access networks correspond to different customer networks; and 

generating means for generating at least one instance for executing a security 
function on a subscriber traffic flow, so that physically one security instance for 
subscribers of at least two wireless access networks is present and logically at least one of 
the at least two wireless access networks has a respective security instance. 

19. (New) A network node comprising: 

connection means for connecting a network node to distributed routing means for 
routing subscriber traffic flow to and from an internet protocol network, wherein the 
distributed routing means routes subscriber traffic flow between at least two wireless 
access networks and an internet protocol network, wherein the at least two wireless 
access networks correspond to different customer networks, and the distributed routing 
device comprises at least one instance for executing a security function on a subscriber 
traffic flow, so that physically one security instance for subscribers of at least two 
wireless access networks is present and logically at least one of the at least two wireless 
access networks has a respective security instance, wherein at least one logical part of the 
security instance is associated with a context of a respective one of the wireless access 
networks and comprises an interface with the respective wireless access network; and 
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modifying means for modifying the context in the at least one logical part of the 
security instance associated with the respective one of the wireless access network via a 
respectively provided interface. 

20. (New) A network system comprising: 

at least two wireless access networks and distributed routing means for routing 
subscriber traffic flow between the at least two wireless access networks and an internet 
protocol network, wherein the distributed routing means routes subscriber traffic flow 
between at least two wireless access networks and an internet protocol network, wherein 
the at least two wireless access networks correspond to different customer networks, and 
the distributed routing means comprises at least one instance for executing a security 
function on a subscriber traffic flow, so that physically one security instance for 
subscribers of at least two wireless access networks is present and logically at least one of 
the at least two wireless access networks has a respective security instance. 
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